[NETFILTER]: Introduce infrastructure for address family specific operations
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / netfilter / core.c
CommitLineData
f6ebe77f
HW
1/* netfilter.c: look after the filters for various protocols.
2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
3 *
4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
5 * way.
6 *
7 * Rusty Russell (C)2000 -- This code is GPL.
8 *
9 * February 2000: Modified by James Morris to have 1 queue per protocol.
10 * 15-Mar-2000: Added NF_REPEAT --RR.
11 * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
12 */
13#include <linux/config.h>
14#include <linux/kernel.h>
15#include <linux/netfilter.h>
16#include <net/protocol.h>
17#include <linux/init.h>
18#include <linux/skbuff.h>
19#include <linux/wait.h>
20#include <linux/module.h>
21#include <linux/interrupt.h>
22#include <linux/if.h>
23#include <linux/netdevice.h>
24#include <linux/inetdevice.h>
25#include <linux/proc_fs.h>
26#include <net/sock.h>
27
28#include "nf_internals.h"
29
bce8032e
PM
30static DEFINE_SPINLOCK(afinfo_lock);
31
32struct nf_afinfo *nf_afinfo[NPROTO];
33EXPORT_SYMBOL(nf_afinfo);
34
35int nf_register_afinfo(struct nf_afinfo *afinfo)
36{
37 spin_lock(&afinfo_lock);
38 rcu_assign_pointer(nf_afinfo[afinfo->family], afinfo);
39 spin_unlock(&afinfo_lock);
40 return 0;
41}
42EXPORT_SYMBOL_GPL(nf_register_afinfo);
43
44void nf_unregister_afinfo(struct nf_afinfo *afinfo)
45{
46 spin_lock(&afinfo_lock);
47 rcu_assign_pointer(nf_afinfo[afinfo->family], NULL);
48 spin_unlock(&afinfo_lock);
49 synchronize_rcu();
50}
51EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
52
f6ebe77f
HW
53/* In this code, we can be waiting indefinitely for userspace to
54 * service a packet if a hook returns NF_QUEUE. We could keep a count
55 * of skbuffs queued for userspace, and not deregister a hook unless
56 * this is zero, but that sucks. Now, we simply check when the
57 * packets come back: if the hook is gone, the packet is discarded. */
58struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
59EXPORT_SYMBOL(nf_hooks);
60static DEFINE_SPINLOCK(nf_hook_lock);
61
62int nf_register_hook(struct nf_hook_ops *reg)
63{
64 struct list_head *i;
65
66 spin_lock_bh(&nf_hook_lock);
67 list_for_each(i, &nf_hooks[reg->pf][reg->hooknum]) {
68 if (reg->priority < ((struct nf_hook_ops *)i)->priority)
69 break;
70 }
71 list_add_rcu(&reg->list, i->prev);
72 spin_unlock_bh(&nf_hook_lock);
73
74 synchronize_net();
75 return 0;
76}
77EXPORT_SYMBOL(nf_register_hook);
78
79void nf_unregister_hook(struct nf_hook_ops *reg)
80{
81 spin_lock_bh(&nf_hook_lock);
82 list_del_rcu(&reg->list);
83 spin_unlock_bh(&nf_hook_lock);
84
85 synchronize_net();
86}
87EXPORT_SYMBOL(nf_unregister_hook);
88
972d1cb1
PM
89int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
90{
91 unsigned int i;
92 int err = 0;
93
94 for (i = 0; i < n; i++) {
95 err = nf_register_hook(&reg[i]);
96 if (err)
97 goto err;
98 }
99 return err;
100
101err:
102 if (i > 0)
103 nf_unregister_hooks(reg, i);
104 return err;
105}
106EXPORT_SYMBOL(nf_register_hooks);
107
108void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
109{
110 unsigned int i;
111
112 for (i = 0; i < n; i++)
113 nf_unregister_hook(&reg[i]);
114}
115EXPORT_SYMBOL(nf_unregister_hooks);
116
f6ebe77f
HW
117unsigned int nf_iterate(struct list_head *head,
118 struct sk_buff **skb,
119 int hook,
120 const struct net_device *indev,
121 const struct net_device *outdev,
122 struct list_head **i,
123 int (*okfn)(struct sk_buff *),
124 int hook_thresh)
125{
126 unsigned int verdict;
127
128 /*
129 * The caller must not block between calls to this
130 * function because of risk of continuing from deleted element.
131 */
132 list_for_each_continue_rcu(*i, head) {
133 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
134
135 if (hook_thresh > elem->priority)
136 continue;
137
138 /* Optimization: we don't need to hold module
139 reference here, since function can't sleep. --RR */
140 verdict = elem->hook(hook, skb, indev, outdev, okfn);
141 if (verdict != NF_ACCEPT) {
142#ifdef CONFIG_NETFILTER_DEBUG
143 if (unlikely((verdict & NF_VERDICT_MASK)
144 > NF_MAX_VERDICT)) {
145 NFDEBUG("Evil return from %p(%u).\n",
146 elem->hook, hook);
147 continue;
148 }
149#endif
150 if (verdict != NF_REPEAT)
151 return verdict;
152 *i = (*i)->prev;
153 }
154 }
155 return NF_ACCEPT;
156}
157
158
159/* Returns 1 if okfn() needs to be executed by the caller,
160 * -EPERM for NF_DROP, 0 otherwise. */
161int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
162 struct net_device *indev,
163 struct net_device *outdev,
164 int (*okfn)(struct sk_buff *),
165 int hook_thresh)
166{
167 struct list_head *elem;
168 unsigned int verdict;
169 int ret = 0;
170
171 /* We may already have this, but read-locks nest anyway */
172 rcu_read_lock();
173
174 elem = &nf_hooks[pf][hook];
175next_hook:
176 verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
177 outdev, &elem, okfn, hook_thresh);
178 if (verdict == NF_ACCEPT || verdict == NF_STOP) {
179 ret = 1;
180 goto unlock;
181 } else if (verdict == NF_DROP) {
182 kfree_skb(*pskb);
183 ret = -EPERM;
184 } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
185 NFDEBUG("nf_hook: Verdict = QUEUE.\n");
186 if (!nf_queue(pskb, elem, pf, hook, indev, outdev, okfn,
187 verdict >> NF_VERDICT_BITS))
188 goto next_hook;
189 }
190unlock:
191 rcu_read_unlock();
192 return ret;
193}
194EXPORT_SYMBOL(nf_hook_slow);
195
196
197int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len)
198{
199 struct sk_buff *nskb;
200
201 if (writable_len > (*pskb)->len)
202 return 0;
203
204 /* Not exclusive use of packet? Must copy. */
205 if (skb_shared(*pskb) || skb_cloned(*pskb))
206 goto copy_skb;
207
208 return pskb_may_pull(*pskb, writable_len);
209
210copy_skb:
211 nskb = skb_copy(*pskb, GFP_ATOMIC);
212 if (!nskb)
213 return 0;
214 BUG_ON(skb_is_nonlinear(nskb));
215
216 /* Rest of kernel will get very unhappy if we pass it a
217 suddenly-orphaned skbuff */
218 if ((*pskb)->sk)
219 skb_set_owner_w(nskb, (*pskb)->sk);
220 kfree_skb(*pskb);
221 *pskb = nskb;
222 return 1;
223}
224EXPORT_SYMBOL(skb_make_writable);
225
226
227/* This does not belong here, but locally generated errors need it if connection
228 tracking in use: without this, connection may not be in hash table, and hence
229 manufactured ICMP or RST packets will not be associated with it. */
230void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
231EXPORT_SYMBOL(ip_ct_attach);
232
233void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb)
234{
235 void (*attach)(struct sk_buff *, struct sk_buff *);
236
237 if (skb->nfct && (attach = ip_ct_attach) != NULL) {
238 mb(); /* Just to be sure: must be read before executing this */
239 attach(new, skb);
240 }
241}
242EXPORT_SYMBOL(nf_ct_attach);
243
244#ifdef CONFIG_PROC_FS
245struct proc_dir_entry *proc_net_netfilter;
246EXPORT_SYMBOL(proc_net_netfilter);
247#endif
248
249void __init netfilter_init(void)
250{
251 int i, h;
252 for (i = 0; i < NPROTO; i++) {
253 for (h = 0; h < NF_MAX_HOOKS; h++)
254 INIT_LIST_HEAD(&nf_hooks[i][h]);
255 }
256
257#ifdef CONFIG_PROC_FS
258 proc_net_netfilter = proc_mkdir("netfilter", proc_net);
259 if (!proc_net_netfilter)
260 panic("cannot create netfilter proc entry");
261#endif
262
263 if (netfilter_queue_init() < 0)
264 panic("cannot initialize nf_queue");
265 if (netfilter_log_init() < 0)
266 panic("cannot initialize nf_log");
267}